[Security-news] SA-CONTRIB-2009-038 - Nodequeue - Multiple vulnerabilities

[security-news at drupal.org]

  * Advisory ID: DRUPAL-SA-CONTRIB-2009-038
  * Project: Nodequeue (third-party module)
  * Version: 5.x, 6.x
  * Date: 2009-June-10
  * Security risk: Moderately critical
  * Exploitable from: Remote
  * Vulnerability: Multiple vulnerabilities

-------- DESCRIPTION  
---------------------------------------------------------

The Nodequeue module enables an administrator to arbitrarily put nodes in a
group for some purpose, such as providing a listing of nodes or featuring a
particular node. It suffers from a cross-site scripting [1] (XSS)
vulnerability due to not properly sanitizing vocabulary names before they are
displayed. Additionally, the module does not respect node access restrictions
when displaying node titles.
-------- VERSIONS AFFECTED  
---------------------------------------------------

  * Nodequeue for Drupal 5.x prior to Nodequeue 5.x-2.7
  * Nodequeue for Drupal 6.x prior to Nodequeue 6.x-2.2

Drupal core is not affected. If you do not use the contributed Nodequeue
module, there is nothing you need to do.
-------- SOLUTION  
------------------------------------------------------------

Upgrade to the latest version:
  * If you use Nodequeue for Drupal 5.x upgrade to Nodequeue 5.x-2.7 [2]
  * If you use Nodequeue for Drupal 6.x upgrade to Nodequeue 6.x-2.2 [3]

See also the Nodequeue project page [4].
-------- REPORTED BY  
---------------------------------------------------------

  * The XSS issue was reported by Justin C. Klein Keane [5].
  * The access bypass issue was reported by Ezra Barnett Gildesgame [6].

-------- FIXED BY  
------------------------------------------------------------

  * The XSS issue was fixed by Justin C. Klein Keane [7].
  * The access bypass issue was fixed by Ezra Barnett Gildesgame [8] and Earl
    Miles [9].

-------- CONTACT  
-------------------------------------------------------------

The security contact for Drupal can be reached at security at drupal.org or
via the form at http://drupal.org/contact.

[1] http://en.wikipedia.org/wiki/Cross-site_scripting
[2] http://drupal.org/node/488104
[3] http://drupal.org/node/488102
[4] http://drupal.org/project/nodequeue
[5] http://drupal.org/user/302225
[6] http://drupal.org/user/69959
[7] http://drupal.org/user/302225
[8] http://drupal.org/user/69959
[9] http://drupal.org/user/26979